Tuned by Design: Why Detection Engineering Needs Its Own Development Lifecycle

This document defines the Use Case Development Lifecycle (UCDL), a six-phase, Tuned-by-Design framework for creating, validating, deploying, measuring, tuning, and retiring detection use cases. It emphasizes threat-driven ideation, data feasibility checks, engineered development (queries, exclusions, playbooks), rigorous validation (true positive simulation and false positive estimation), continuous production measurement, and formal retirement to avoid rule bloat.